Rule Info
Name
New Kubernetes Service Account Created
Author
Leo Tsaousis (@laripping)
Description
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
Reference
Date
2024-03-26 00:00:00
Modified
None
Id
e31bae15-83ed-473e-bf31-faf4f8a17d36
Tags
attack.t1136 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR